Because the default privacy setting for photo albums is "visible to everyone", and most people don't realize that it's independent from profile privacy. It's o

Because the default privacy setting for photo albums is "visible to everyone", and most people don't realize that it's independent from profile privacy. It's one of the many flaws of facebook's privacy (at least for an ordinary user who isn't web-savvy). Also - even if she totally locked down her profile, the photos of her could have been uploaded by friends with more lenient privacy settings.